Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

A newly reported security incident has put managed service providers and their customers on high alert after attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants without authorization. The activity highlights how a single stolen credential tied to a trusted backup and management tool can open the door to many organizations at once.

Because the details of this incident are still emerging, this article sticks to what has been reported and to general lessons the security community already recognizes. Where the specifics remain unclear, we say so rather than speculate about the exact methods or the full scope of any data exposure.

What Happened in the ConnectWise Cloud Backup Incident

According to the report, attackers obtained a credential associated with ConnectWise Cloud Backup and used it to perform unauthorized sign-ins across 173 Microsoft 365 tenants. The credential appears to have had enough access to authenticate into multiple customer environments, which is what made the activity so far-reaching.

Cloud backup tools typically need broad permissions so they can read mailboxes, files, and other Microsoft 365 data. When such a tool's credential is compromised, an attacker may inherit that same level of trust across every tenant connected to it.

It is important to note that sign-in activity is not the same as confirmed data theft. Affected organizations will need to review their own logs to determine what, if anything, was accessed after the unauthorized authentication occurred.

Why a Single Credential Can Affect So Many Tenants

Managed service providers and backup vendors often hold privileged, delegated access to many customer environments. This design is efficient for operations, but it concentrates risk into a small number of credentials and integrations.

If an attacker obtains one of these credentials, they can potentially move from tenant to tenant using the same trusted pathway. Defenders sometimes struggle to distinguish this activity from legitimate backup operations, since the sign-ins may originate from a recognized application.

This is a classic example of a supply chain style risk. The victims did not necessarily make a mistake in their own configuration; the exposure came through a third-party tool they relied on.

The Growing Risk of Third-Party and Supply Chain Access

Attackers have increasingly targeted the tools that IT providers use to manage customers, because compromising one provider can yield access to dozens or hundreds of downstream organizations. Remote management platforms, backup services, and similar tools are especially attractive targets.

For businesses, this means security cannot stop at the edge of their own network. The permissions granted to vendors and integrated applications need the same scrutiny as those granted to employees.

Regular reviews of enterprise applications, consent grants, and service principals in Microsoft 365 can reveal access that is broader than necessary or no longer in use.

How Organizations Can Check Whether They Were Affected

Administrators who use ConnectWise Cloud Backup should begin by reviewing Microsoft Entra ID sign-in logs for unusual activity tied to the backup application or related service accounts. Look for unfamiliar IP addresses, unexpected locations, and sign-ins at odd times.

It is also wise to examine audit logs for changes to mailbox rules, permissions, application registrations, and conditional access policies. These are common actions attackers take to maintain persistence or hide their activity.

Organizations should follow any guidance published by ConnectWise and Microsoft, and contact their provider directly if they are unsure whether their tenant was among those impacted.

Immediate Steps to Contain and Reduce the Damage

If suspicious activity is found, the first priority is to revoke and rotate the affected credentials, secrets, and tokens. Active sessions tied to the compromised access should be terminated so the attacker cannot continue using them.

Next, review and tighten the permissions granted to the backup integration. Apply the principle of least privilege so that the tool has only the access it truly needs to function.

Document everything during the response. Preserved logs and timelines will help with internal investigations, regulatory obligations, and any communication with customers or partners.

Strengthening Identity Security in Microsoft 365

Identity has become the primary attack surface for cloud environments. Enforcing strong authentication, conditional access policies, and restrictions on where service accounts can sign in from can limit what a stolen credential can do.

Where possible, use workload identities and managed credentials that are harder to steal and easier to rotate. Monitoring for anomalous behavior from non-human accounts is just as important as monitoring user accounts.

Alerting on new sign-in locations, impossible travel, and unusual API activity can shorten the time between compromise and detection, which is often the deciding factor in how severe an incident becomes.

What Managed Service Providers Should Take Away

Providers carry an outsized responsibility because their credentials unlock many customer environments. Segmenting access, using separate credentials per customer, and limiting standing privileges can reduce the blast radius of a single compromise.

Prompt, transparent communication matters as well. Customers need timely information about indicators of compromise and recommended actions so they can protect themselves quickly.

Regular credential audits, secret rotation, and tight monitoring of administrative tools should be treated as baseline practices rather than optional extras.

Looking Ahead After the 173 Tenant Compromise

This incident is a reminder that trusted tools can become attack paths when their credentials fall into the wrong hands. As more organizations rely on cloud services and third-party integrations, the need for careful access management will only grow.

We will continue to follow developments as ConnectWise, Microsoft, and security researchers share more information. Readers should watch for official advisories and act quickly on any recommended mitigations.

For now, the best response is practical: review your logs, rotate your credentials, limit third-party permissions, and make sure your team knows how to respond if a trusted integration is ever abused.

If you have any questions, please don't hesitate to Contact Us